CVE-2026-28434
📋 TL;DR
This vulnerability in cpp-httplib leaks internal exception messages to unauthenticated clients when request handlers throw C++ exceptions. Any application using cpp-httplib versions before 0.35.0 without custom exception handlers is affected, potentially exposing sensitive debugging information.
💻 Affected Systems
- cpp-httplib
📦 What is this software?
Cpp Httplib by Yhirose
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain detailed internal exception messages revealing stack traces, file paths, variable values, or other sensitive debugging information that could aid further attacks.
Likely Case
Information disclosure of internal application details that could help attackers understand application structure and identify other vulnerabilities.
If Mitigated
No information leakage when proper exception handling is implemented.
🎯 Exploit Status
Exploitation requires triggering exceptions in request handlers, which could be done through malformed requests or normal error conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.35.0
Vendor Advisory: https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-8mpw-r4gc-xm7q
Restart Required: Yes
Instructions:
1. Update cpp-httplib to version 0.35.0 or later. 2. Recompile your application with the updated library. 3. Restart the application/service.
🔧 Temporary Workarounds
Register custom exception handler
allImplement set_exception_handler() to handle exceptions without leaking details.
svr.set_exception_handler([](const auto& req, auto& res, std::exception_ptr ep) { res.set_content("Internal server error", "text/plain"); });
🧯 If You Can't Patch
- Implement custom exception handler using set_exception_handler() to prevent information leakage.
- Deploy network filtering to block or sanitize HTTP responses containing EXCEPTION_WHAT headers.
🔍 How to Verify
Check if Vulnerable:
Check if application uses cpp-httplib version <0.35.0 and doesn't call set_exception_handler().Check Version:
Check your source code for cpp-httplib version or build configuration.Verify Fix Applied:
Verify cpp-httplib version is ≥0.35.0 and test that exceptions no longer produce EXCEPTION_WHAT headers.📡 Detection & Monitoring
Log Indicators:
- HTTP responses containing EXCEPTION_WHAT headers
- Unusual exception patterns in application logs
Network Indicators:
- HTTP responses with EXCEPTION_WHAT header in traffic captures
SIEM Query:
http.response.headers contains "EXCEPTION_WHAT"